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I. Introduction 


1. This complaint concerns proposed changes in the business practices of Uber,' the 
largest “ridesharing” service in the United States’. In less than four weeks, Uber 
will claim the right to collect personal contact information and detailed location 
data of American consumers, even when they are not using the service.’ These 
changes ignore the FTC’s prior decisions, threaten the privacy rights and personal 
safety of American consumers, ignore past bad practices of the company involving 
the misuse of location data, pose a direct risk of consumer harm, and constitute an 
unfair and deceptive trade practice subject to investigation by the Federal Trade 
Commission. 


II. Parties 


2. The Electronic Privacy Information Center (“EPIC”) is a public interest research 
center located in Washington, D.C. EPIC focuses on emerging privacy and civil 
liberties issues and is a leading consumer advocate before the FTC. EPIC has a 
particular interest in protecting consumer privacy and has played a leading role in 





' Katherine Tassi, An Update On Privacy at Uber, UBER.COM, (May 28, 2015), 
http://newsroom.uber.com/2015/05/an-update-on-privacy-at-uber/. 

? Daniel Miller, Lyft vs. Uber: Just How Dominant Is Uber in the Ridesharing Business?, THE MOTLEY 
FOOL (May 24, 2015), http://www.fool.com/investing/general/2015/05/24/lyft-vs-uber-just-how-dominant- 
is-uber-ridesharing.aspx. The term “ridesharing” is frequently used to describe Uber. But of course Uber is 
a massive, commercial transportation service; passengers pay for rides, drivers receive a fee for each ride, 
and Uber collects a substantial fee and an enormous amount of personal data from the provision of the 
service. To describe Uber as a “sharing service” is akin to describing a hybrid dinosaur as a “theme park 
attraction.” See Jurassic World. 

? Id; see also Privacy Statements, UBER.COM, https://www.uber.com/legal/privacy-proposed/users/en (last 
visited June 14, 2015). 
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developing the authority of the FTC to address emerging privacy issues and to 
safeguard the privacy rights of consumers,’ EPIC’s complaint concerning Google 
Buzz provided the basis for the investigation and subsequent settlement in which 
the Commission found that “Google used deceptive tactics and violated its own 
privacy promises to consumers when it launched [Buzz].”” The Commission’s 
settlement with Facebook also followed from a Complaint filed by EPIC and a 
coalition of consumer privacy organizations.° 


3. Uber is an American company incorporated in Delaware since 2010.’ Uber’s 
primary place of business is 1455 Market St., Suite 400, San Francisco, CA 94103.° 
The Uber app allows the company to collect detailed personal information from 
consumers.” 


IHI. Factual Background 





A. Uber’s Business Practices Affect Millions of Consumers 


4. Uber is a massive transportation company that pays local drivers to provide rides for 
hire based on the collection of detailed customer information, including location 
data, and payment and billing information. "° 





* See, e.g., Letter from EPIC Exec. Dir. Marc Rotenberg to FTC Comm’r Christine 

Varney (Dec. 14, 1995) (urging the FTC to investigate the misuse of personal information by the 

direct marketing industry), http://epic.org/privacy/internet/ftc/ftc_letter.html; DoubleClick, Inc., FTC File 
No. 071-0170 (2000) (Complaint and Request for Injunction, Request for Investigation and for Other 
Relief), http://epic.org/privacy/internet/ftc/DCLK_complaint.pdf; Microsoft Corporation, FTC File No. 012 
3240 (2002) (Complaint and Request for Injunction, Request for Investigation and for Other Relief), 
http://epic.org/privacy/consumer/MS_complaint.pdf; Choicepoint, Inc., FTC File No. 052-3069 (2004) 
(Request for Investigation and for Other Relief), http://epic.org/privacy/choicepoint/fcraltr12.16.04.html. 

> Press Release, Federal Trade Comm’n, FTC Charges Deceptive Privacy Practices in Google’s Rollout of 
Its Buzz Social Network (Mar. 30, 2011), http://ftc.gov/opa/2011/03/google.shtm (“Google’s data practices 
in connection with its launch of Google Buzz were the subject of a complaint filed with the FTC by the 
Electronic Privacy Information Center shortly after the service was launched.”). 

° In the Matter of Facebook, Inc., (2009) (EPIC Complaint, Request for Investigation, Injunction, and Other 
Relief), https://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf [hereinafter EPIC 2009 
Facebook Complaint]; In the Matter of Facebook, Inc., (2010) (EPIC Supplemental Materials in Support of 
Pending Complaint and Request for Injunction, Request for Investigation and for Other Relief), 
https://epic.org/privacy/inrefacebook/EPIC_Facebook_Supp.pdf [hereinafter EPIC 2009 Facebook 
Supplement]; In the Matter of Facebook, Inc., (2010) (EPIC Complaint, Request for Investigation, 
Injunction, and Other Relief) , https://epic.org/privacy/facebook/EPIC_FTC_FB_ Complaint.pdf 
[hereinafter EPIC 2010 Facebook Complaint]. 

’ General Information Name Search, Delaware Department of State: Division of Corporations, 
https://delecorp.delaware.gov/tin/controller (last visited June 12, 2015) 

3 Official Rules for Uber Contests and Sweepstakes, UBER.COM (May 2, 2015), 
http://newsroom.uber.com/uberidsweepstakes/. 

? Company Overview of Uber Technologies, Inc., BLOOMBERG BUSINESS (June 12, 2015), 
http://www.bloomberg.com/research/stocks/private/snapshot.asp?privcapId=144524848. 

1 John Patrick Pullen, Everything You Need to Know About Uber, TIME (Nov. 4, 2014), 
http://time.com/355674 1 /uber/. 
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5. Uber has over 8 million users worldwide'' and, with approximately 150 U.S. 
markets!” and 160,000 American drivers," is one of the largest transportation 
services in the USA. 


6. In March 2015, Uber accounted for almost half of all rides expensed by employees 
whose companies use Certify, the second-largest provider of travel and expense 
management software in North America.'* In March 2014, Uber accounted for only 
15% of companies that use Certify — a jump of nearly 35%. In some cities, such as 
San Francisco and Dallas, Uber accounts for the majority of such rides.’ 


7. The company collects detailed personal information, including email, password, 
name, mobile phone number, zip code, and credit card information; “usage 
information,” such as browser and URL; and “device identifiers,” such as IP 
address, GPS coordinates, and cookies.'° 


8. Uber claims that it may disclose sensitive personal information to third parties, 
unaffiliated with the provision of the services to the customer.” 


9. A top Uber executive in New York City was investigated for tracking the location of 
journalists reporting on the company.'® The practice was specifically intended to 
identify and track critics of the company, 


10. Prior to the emergence of Uber and other similar services, American consumers 
could routinely hire taxis without any disclosure of personal information or any 
tracking of their location. 


B. Uber’s Official Statements Purport to Respect User Privacy 
11. Uber revised its “Privacy Policy” on May 28, 2015. Under the revised terms of use, 


Uber claims that “users will be in control: they will be able to choose whether to 
share the data with Uber.” 





' Lauren Moss, Uber Spearheads Growth of The Shared Economy in Mexico, GLOBAL DELIVERY REPORT 
(July 9, 2014), http://globaldeliveryreport.com/uber-spearheads-growth-of-the-shared-economy-in-mexico/. 
? Cities, UBER.COM, https://www.uber.com/cities (last visited June 12, 2015). 
> Chris O’Brien, Princeton economist explains why we should all stop worrying and learn to love Uber, 
VENTUREBEAT (Jan. 22, 2015), http://venturebeat.com/2015/01/22/inside-ubers-staggering-u-s-growth- 
40000-drivers-joined-in-december-and-average-19-per-hout/. 
* Brad Stone, Uber is Winning over Americans' Expense Accounts, Bloomberg, (June 19, 2015), 
http://www.bloomberg.com/news/articles/2015-04-07/uber-is-winning-over-americans-expense-accounts. 
Id. 
° Legal, UBER, Attps://www.uber.com/legal/usa/privacy (last visited June 19, 2015). 
Id. 
8 Johana Bhuiyan & Charlie Warzel, “God View”: Uber Investigates Its Top New York Executive For 
Privacy Violations, BUZZFEED (Nov. 18, 2014), http://www.buzzfeed.com/johanabhuiyan/uber-is- 
investigating-its-top-new-york-executive-for-privacy#.scMOymgne. 
” Tassi, supra note 1. 
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12. Specifically, the revised privacy policy states: 


Location Information: When you use the Services for transportation 
or delivery, we collect precise location data about the trip from the 
Uber app used by the Driver. If you permit the Uber app to access 
location services through the permission system used by your mobile 
operating system (“platform”), we may also collect the precise location 
of your device when the app is running in the foreground or 
background. We may also derive your approximate location from your 
IP address. 


Contacts Information: If you permit the Uber app to access the 
address book on your device through the permission system used by 
your mobile platform, we may access and store names and contact 
information from your address book to facilitate social interactions 
through our Services and for other purposes described in this Statement 
or at the time of consent or collection. 


Important Information About Platform Permissions: Most mobile 
platforms (iOS, Android, etc.) have defined certain types of device data 
that apps cannot access without your consent. And these platforms have 
different permission systems for obtaining your consent. The iOS 
platform will alert you the first time the Uber app wants permission to 
access certain types of data and will let you consent (or not consent) to 
that request. Android devices will notify you of the permissions that the 
Uber app seeks before you first use the app, and your use of the app 
constitutes your consent. oF 


13. Uber further stated, “We care deeply about the privacy of our riders and drivers. It’s 
why we’re always looking at ways to improve our practices.””! 


14. Ina statement released on May 28, 2015, Uber stated that the company will 
routinely collect user location data because “location data is essential to connect 
drivers to riders, while features like ‘Split Fare’? only work if Uber has access to a 
rider’s contact details.””° 





°° Privacy Statements, UBER.COM, https://www.uber.com/legal/privacy-proposed/users/en (last visited June 
14, 2015) (emphasis added). 

” Jq. 

?? Riders can split the fare of the ride by choosing the “Split Fare” option within the Uber app. They then 
select one of their phone’s contacts and tap a link within the app to send a message the person requesting to 
split the fare of the ride. If the contact confirms the ride fare may be split, then Uber will charge the riders 
equally. Brian, Fare Splitting = Fair Splitting, UBER.COM (July 15, 2013), 
http://newsroom.uber.com/2013/07/faresplit/. 

3 Tassi, supra note 1. 
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15. An Uber spokesperson stated that tracking passengers in real time and accessing 
users’ address books are merely “potential new use cases” of its customers’ data. 
“We are not currently collecting this data and have no plans to start on July 15... .If 
we decide to ask for these permissions, users will be in control and choose whether 
they want to share the data with Uber.” The spokesperson stated that if the company 
ever launches those features, the app would still work even if the user opts out of the 
above uses.” 


16. But virtually everyone who has reviewed the proposed changes in business practices 
has understood that the company plans even more expansive and more invasive uses 
of personal data even after it has engaged in egregious practices with the personal 
data in it possession. As one writer observed: 


The car booking company now more clearly tells its customers it can 
pretty much track everything they do while using the Uber app, after 
facing criticism over privacy, especially its use of a tool called God View 
enabling the company to know where its riders were at any given 
moment. 


C. Uber’s Revised Business Practices Will Allow the Company to Routinely Track 
the Location of Internet Users Even When They are not Customers of Uber 


17. Uber’s revised privacy policy creates several risks for American consumers. ~° 


18. Uber will now collect the precise location of the user when the app is running in the 
foreground through traditional GPS location services.” 


19. Uber will also collect precise location information if the app is operating in the 
background.** On phones running iOS, this means that Uber may be able collect 
location data even after an app has been terminated by the user.” 





” Jd. 

35 See, e..g, Eric Newcomer, “Uber Broadens Rider Privacy Policy, Asks for New Permissions,” Bloomberg 
Business, May 28, 2015, http:/(www.bloomberg.com/news/articles/2015-05-28/uber-broadens-rider- 
privacy-policy-asks-for-new-permissions 

°° Natasha Singer, Sharing Data, But Not Happily, NYTIMES.COM (June 4, 2015), 
http://www.nytimes.com/2015/06/05/technology/consumers-conflicted-over-data-mining-policies-report- 
finds. html 

*1 See Privacy Statements, supra note 19. 

28 Privacy Statements, supra note 19; see also Receiving Location Updates, ANDROID DEVELOPERS, 
https://developer.android.com/training/location/receive-location-updates.html (last visited June 19, 2015) 
(“Consider whether you want to stop the location updates when the activity is no longer in focus, such as 
when the user switches to another app or to a different activity in the same app.”) (emphasis added). 

? Background Execution, IOS DEVELOPER LIBRARY (Sept. 17, 2014), 
https://developer.apple.com/library/ios/documentation/iPhone/Conceptual/iPhoneOS ProgrammingGuide/B 
ackgroundExecution/BackgroundExecution.html. (“If the app starts this service and is then terminated, the 
system relaunches the app automatically when a new location becomes available.”) 
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20. Even ifa user disables the GPS location services on their phone, the company may 
still derive approximate location from riders’ IP addresses.*° 


21. This collection of user’s information far exceeds what customers expect from the 
transportation service. Users would not expect the company to collect location 
information when customers are not actively using the app, or have turned off their 
GPS location finder (as Uber can still collect location information through the 
phones’ IP addresses). 


22. Further, given Uber’s statement that it will collect location data from a user’s device 
only “[i]f you permit it to,”’' a user would reasonably assume that the company 
does not track his or her location by other means. In fact, Uber may continue to 
“derive your approximate location from your IP address.” 


23. Uber claims that it can use that information for additional purposes, to which the 
individuals in the contact list have not consented. ° Such purposes may include 
“facilitating social interactions,”** and “allow[ing] Uber to launch new promotional 
features that use contacts — for example the ability to send special offers to riders’ 
friends or family.”*° 


24. Uber claims that it will allow users to opt-out of these features. However, this 
change in business practices places an unreasonable burden on consumers and is not 
easy to exercise: while iOS users can later disable the contact syncing option by 
changing the contacts setting on their mobile devices, the Android platform does not 
provide any such setting.*° 


25. These statements could lead users to believe that that they can choose to not 
share location data with the company after downloading the app, which is 
not true. 





*° John Ribeiro, Uber Revises Privacy Policy, Wants More Data From Users, NETWORKWORLD.COM (May 
28, 2015), http://www.networkworld.com/article/29285 13/uber-revises-privacy-policy-wants-more-data- 
from-users.html. 

3! Privacy Statements, UBER.COM, https://www.uber.com/legal/privacy-proposed/users/en (last visited June 


ENGADGET.COM (May 31, 2015), http://www.engadget.com/2015/05/3 1/uber-privacy-policy-changes/. 
34 P 

Privacy Statements, supra note 19. 
3 Dara Kerr, Uber Updates Privacy Policy, But Can Still Track Users, CNET (May 29, 2015), 
http://www.cnet.com/news/uber-updates-privacy-policy-but-can-still-track-users/. 
°° Sunainaa Chadha, If You Have An Android Phone, Uber’s New Privacy Policy Will Spook You, 
FIRSTPOST.COM, (May 29, 2015), http://www. firstpost.com/business/android-phone-ubers-new-privacy- 
policy-will-spook-2269042.html. 
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26. Uber’s representation that “users will be in control: they will be able to choose 
whether to share the data with Uber”? is contradicted by the change in business 


practices Uber plans to implement on July 15, 2015. 
D. Uber Regularly Abuses Its Access to Customer Location Data 


27. Uber has a history of abusing the location data of its customers. Until recently, 
individual employees could use “God View,” an “easily accessible” internal 
company tool, to obtain a specific user’s real-time and historic location without the 
customer’s knowledge.*® 


28. One anonymous employee said that “[w]hat an Uber employee would have [access 
to] is everything, complete.” Staff across the company could access a customer’s 
name, immediate location data, and Uber trip logs. *” With God View, they could 
track a rider as she moved. 


29. Uber used God View when Uber employees tracked a Buzzfeed journalist doing a 
story on the company. Unprompted and without permission, an Uber employee 
emailed the logs of some of the journalist’s Uber trips, which included time stamps 
and Uber communications.*! 


30. An Uber general manager also tracked the journalist in real time as she traveled to 
an interview. She wrote that he was waiting for her when the vehicle pulled up, 
saying “[tJhere you are. I tracking you” as he motioned to his iPhone.” 


31. Job interviewees have been granted provisional access all the customer location data 
available to full-time employees, allowing non-Uber employees to temporarily track 
any customer.” One such interviewee was granted this access for an entire day, 
even after the job interview ended. He admitted using the database to search records 
of people he knew, including politician’s relatives.“ 


32. At the 2011 Uber Chicago launch party, the company displayed a large real-time 
map of New York City on a screen, allowing guests to visually track named Uber 





37 
Id. 
38 Johana Bhuiyan & Charlie Warzel, “God View”: Uber Investigates Its Top New York Executive For 
Privacy Violations, BUZZFEED (Nov. 18, 2014), http://www.buzzfeed.com/johanabhuiyan/uber-is- 
investigating-its-top-new-york-executive-for-privacy#.scMOymgne [hereinafter, Bhuiyan & Warzel, “God 
View”’]. 
3 Craig Timberg, Is Uber’s Rider Database a Sitting Duck for Hackers?, WASH. POST (Dec. 1, 2014), 
http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/01/is-ubers-rider-database-a-sitting-duck- 
for-hackers/ [hereinafter, Timberg, Rider Database]. 
4 Bhuiyan & Warzel, “God View”, supra. 
41 
Id. 
* Jd, 
& Timberg, Rider Database, supra. 
“Id. 
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passengers who were riding in Uber cabs at the time, without the users’ permission 
or knowledge.” 


33. Ata dinner in November 2014, Uber Senior Vice President Emil Michael 
announced a plan to spend $1 million to have Uber opposition researchers 
investigate information on the “personal lives [and] families” of journalists who 
criticized Uber.*® He went on to say that the researchers should particularly 
investigate and disseminate the private life details of a specific female tech 
journalist.” 


34. Ina blog post titled “Rides of Glory,” Uber reported that it “examined its rider data, 
sorting it for anyone who took an Uber between 10 p.m. and 4 a.m. on a Friday or 
Saturday night. Then it looked at how many of those same people took another ride 
about four to six hours later — from at or near the previous nights’ drop-off point. . . . 
Consider it the Uber walk of shame.”**® 


35. The company has released a statement that its privacy policy internally “applies to 
all employees: access to and use of data is permitted only for legitimate business 
purposes. Data security specialists monitor and audit that access on an ongoing 
basis.” However, as seen above, what Uber considers to be “legitimate business 
purposes” is far broader than the average customers would imagine. 


E. Uber Customers Object to Uber’s Revised Business Practices 
36. Commenter jameskatt2 noted that Uber’s new policy “is very creepy. Uber now 
wants to track your location at all times. That could be a useful resource for the 


police, FBI, NSA, hackers, ete.” 


37. User John b. wrote, “iOS allows to turn off location tracking, etc. at the app level 
(Privacy -> Location Services). And this is why that’s needed. “While Using” is one 





45 Peter Sims, Can We Trust Uber?, MEDIUM (Sept. 26, 2014), https://medium.com/silicon-guild/can-we- 
trust-uber-c0e793deda36. 

46 Craig Timberg, et al. Uber Executive Stirs Up Privacy Controversy, WASH. POST (Nov. 18, 2014), 
available at http://www.washingtonpost.com/business/technology/uber-executive-stirs-up-privacy- 
controversy/2014/11/18/d0607836-6f61-11e4-ad12-3734c46leab6_story.html [hereinafter, Timberg, 
Executive]. 

41 Ben Smith, Uber Executive Suggests Digging Up Dirt on Journalists, BUZZFEED (Nov. 17, 2014), 
http://www.buzzfeed.com/bensmith/uber-executive-suggests-digging-up-dirt-on-journalists#.riGAqAn55a 
“8 Kai Ryssdal, Uber's data makes a creepy point about the company, MARKETPLACE (Nov. 18, 2014), 
available at http://www.marketplace.org/topics/business/final-note/ubers-data-makes-creepy-point-about- 
company. 

” Id, 

°° jameskatt2, Comment to Uber to allow background location tracking in privacy policy update, APPLE 
INSIDER (May 31, 2015, 01:26 PM), http://appleinsider.com/articles/15/05/29/uber-to-allow-background- 
location-tracking-in-privacy-policy-update. 
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thing, “Always” is something else entirely. There is no valid reason for apps like 
these to have 24/7 location data. Same things with Contact data. . . . SMH.””' 

38. User BeowultSchmidt posted: “Well, that pretty much settles the question of me 
ever using Uber, as either a passenger or a driver.” ” 


39. User gev posted: 


I contacted Uber to ask about opting out of its having access to my 
personal contacts which enables Uber to send those people spam and 
unsolicited marketing emails. The whole concept really, really makes me 
angry. The response I got was that all of the information collected is 
encrypted so I shouldn’t worry - which evaded the entire point. I don’t 
give a rip if it is encrypted. Uber should not have this sort of access. 
(Maybe it’s Uber’s version of The Patriot Act and the ability to 
unjustifiably collect droves of personal information on us all.) 


I don’t want companies trolling my personal data like contacts, and 
using it essentially harrass (sic) my friends and family. If I can’t opt out 
I will no longer use Uber. This new policy is the ultimate in sleazy 
business practices. It is not like Uber doesn’t make money from other 
means, like the fares we users pay to use the service. 


I think this comes down to unmitigated greed, and the ability to sell that 
data base when Uber has its IPO.” 


40. User Rayz wrote, “Wouldn’t tracking constantly drain the phone batter? And they 
need to bolster their ethics team, not the legal department.”** 


41. User Jeff Allen told the New York Times, “I think it’s none of their business where I 
am up until the moment when I elect to use their service.” 





>! john.b, Comment to Uber to allow background location tracking in privacy policy update, APPLE 
INSIDER (May 29, 2015, 06:10 PM), http://appleinsider.com/articles/15/05/29/uber-to-allow-background- 
location-tracking-in-privacy-policy-update. 

5? beowulfschmidt, Comment to Uber to allow background location tracking in privacy policy update, 
APPLE INSIDER (May 31, 2015 07:44 AM), http://appleinsider.com/articles/15/05/29/uber-to-allow- 
background-location-tracking-in-privacy-policy-update. 

53 gev, Comment to Uber to allow background location tracking in privacy policy update, APPLE INSIDER 
(May 30, 2015, 09:17 PM), http://appleinsider.com/articles/15/05/29/uber-to-allow-background-location- 
tracking-in-privacy-policy-update. 

54 rayz, Comment to Uber to allow background location tracking in privacy policy update, APPLE INSIDER 
(May 29, 2015, 11:54 PM), http://appleinsider.com/articles/15/05/29/uber-to-allow-background-location- 
tracking-in-privacy-policy-update. 

55 Natasha Singer, Sharing Data, but Not Happily, N.Y. TIMES, June 4, 2015, at B1, available at 
http://www.nytimes.com/2015/06/05/technology/consumers-conflicted-over-data-mining-policies-report- 
finds.html? r=1. 
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42. Twitter user Matt Keish wrote, “Read this, then walk everywhere. 
https://www.uber.com/legal/privacy-proposed/users/en. . . .”°° 


43. User SpiderOak posted, “Let's go with definitely not necessary: “Are Uber's New 
#Privacy Changes Creepy Or Necessary?’””’ 


44. User Jeffrey Paul wrote, “Uber admits to stealing your whole address book.” 
45. Uber driver and Twitter user @driver_mack noted “Uber's new driver privacy 
policy says they can share my info to general public if I blog or tweet. Amongst 


many other worrying things.”””’ 


46. User Richard Regen wrote, “Just when you thought you got back a little privacy 
after the Patriot Act expired, you lost it all in @Uber’s new privacy statement.” 


47. User E.J. Coughlin posted, “Uber’s new privacy statement: ‘Privacy is an 
illusion.””*! 


48. User Jamie Boudreau commented, “I like that if someone else is connected to you 
they still get your info as they'll comb through their contacts. . . .”° 


49. User @nakish19 77 posted, “If you have an Android phone, Uber’s new privacy 
policy will spook you.” @nakish19_ 77 posted further, “Uber revises privacy 


. 64 
policy, wants more #data from users.” 


50. User ReggieVaitz wrote, “Once u use @uber u sign away ur privacy!!” © 





°° Matt Keish (@mattro), TWITTER (June 9, 2015, 5:25 PM), 
https://twitter.com/mattro/status/608429628324257792. 

°7 @SpiderOak, TWITTER (June 9, 2015, 6:16 AM), 
https://twitter.com/SpiderOak/status/60826 1262703624192. 

°8 Jeffrey Paul (@sneakatdatavibe), TWITTER (June 8, 2015, 4:21 PM), 
https://twitter.com/sneakatdatavibe/status/60805 1 128656347136. 

°° @driver_mack, TWITTER (June 4, 2015, 4:16 PM), 
https://twitter.com/driver_mack/status/606600429380767744. 

© Richard Regen (@realrichregen), TWITTER (June 8, 2015, 1:35 PM), 
https://twitter.com/realrichregen/status/608009501069950977. 

° E.J. Coughlin (@ejc), TWITTER (June 8, 2015, 1:52 PM), 
https://twitter.com/ejc/status/6080 137657878 15937. 

€ Jamie Boudreau (@JamieBoudreau), TWITTER (June 8, 2015, 2:54 PM), 
https://twitter.com/JamieBoudreau/status/608029243621015552. 

& @nakish19_77, TWITTER (June 1, 2015, 7:21 AM), 
https://twitter.com/Nakish19_77/status/605378696866885633. 

6 @nakish19_77, TWITTER (June 1, 2015, 6:49 PM), 
https://twitter.com/Nakish19_77/status/60555 1695637135360. 

6 ReggieVaitz (@ReggieVaitz), TWITTER (June 2, 2015, 9:24 AM), 
https://twitter.com/ReggieVaitz/status/60577 1871636713473. 
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51. User Lawrence Mulligan posted, “@Uber 's new privacy statement could also be 
described as a no-privacy statement @PandoDaily @mashable @SFGate.”” 


52. Twitter user Michael Keller, wrote: 


Uber’a new geolocation terms show why opt-in / out is a broken privacy 
concept: 


[attached image reads:] “The company’s new privacy policy, scheduled to 
take effect on July 15, says that if customers permit the Uber app to 
connect to location data, the app may collect the precise locations of their 
devices whether the app is running in the foreground or the background. 
Whether or not customers turn on that permission, the app still may deduce 
their general location based on other signals from their devices. 


And, if consumers use the ride-hailing app on or after that date, the 
company will conclude that they have read and agreed to the terms, Uber 
said in a recent email to customers. 


In other words, Uber customers may resign themselves to having their data 
extracted — or forgo the service altogether.”®” 


53. Belgian law professor Anne-Lise Sibony posted, “Time to think about your own 
privacy v convenience tradeoff #Uber.””* 


54. User Javier Blanco H. posted, “#Uber’s new privacy policy admits that riders have 
no privacy.” 


55. User Christopher Silsby wrote, “As if their privacy violation, lack of regulation, and 
harassment of reporters weren't enough reason to dislike Uber.” 7° 


56. Twitter user @injudiciouslex posted, “Users personal tracking with opt in not much 
relief following the ‘god view’ and ‘rides of glory’ privacy breaches.” ”' 





°° Lawrence Mulligan (@lawkercai), TWITTER (June 11, 2015, 10:56 AM), 
https://twitter.com/lawkercai/status/609056742 119473153. 

67 Michael Keller (@mhkeller), TWITTER (June 4, 2015, 2:22 PM), 
https://twitter.com/mhkeller/status/60657 1825385095169 (quoting Singer, supra note 37). 
68 Anne-Lise Sibony (@AnneLiseSibony), TWITTER (May 31, 2015, 12:25 PM), 
https://twitter.com/AnneLiseSibony/status/605092634294661 121. 

®© Javier Blanco H. (@JavierBlancoH), TWITTER (June 1, 2015, 7:00 AM), 
https://twitter.com/JavierBlancoH/status/605373405 102272512. 

7 Christopher Silsby (@silsbyc), TWITTER (June 1, 2015, 4:08 AM), 
https://twitter.com/silsbyc/status/60533007 1641944065. 

7! @injudiciouslex, TWITTER (May 31, 2015, 6:35 PM), 
https://twitter.com/injudiciouslex/status/605 1859269736284 16. 
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F. Uber Fails to Take Adequate Security Measures to Protect Its Database of User 
Information 


57. Uber proposes to changes its business practices with this revised privacy policy: 


We may transfer the information described in this Statement to, and 
process and store it in, the United States and other countries, some of 
which may have less protective data protection laws than the region in 
which you reside. Where this is the case, we will take appropriate 
measures to protect your personal information in accordance with this 
Statement.” 


58. However, multiple security experts have stated that Uber is the largest ever “cyber- 
espionage target” of its kind (taxi, car service, or other such private entity). Uber is 
a popular service in Washington, D.C., having accounted for more than 60% of 
Congressional rides under $100 during the 2014 mid-term Congressional campaign 
season. 


59. In spring 2014, Uber suffered data breach that potentially exposed over 50,000 
former and current drivers’ names and license plates. The company did not discover 
the breach until September 17, 2014 and failed to notify the drivers until February 
27, 2015." 


60. A cyber-security expert at the Center for Strategic and International Studies, said 
that Uber customers’ personal information is “likely vulnerable” to a hack.”° 


61. A Washington Post reporter wrote that Uber’s data represents a significant 
“cybersecurity risk of collected massive troves of private travel information in 
online databases.””” 


G. Privacy Experts Identify Uber’s Customer Location Abuses As Particularly 
Egregious 


62. Bruce Schneier, the author of Data and Goliath: The Hidden Battles to Collect Your 
Data and Control Your World (Norton 2015), pointed to Uber’s God View as a 
prime reason for why the Federal Trade Commission should act to protect consumer 





” Privacy Statements, supra note 619. 

® Id. 

“Tom Kise, Congress Votes Uber, Hamilton Place Stategies (Nov. 2014), available at 
http://www.hamiltonplacestrategies.com/news/uber-congress-new-private-driver. 

® Tracey Lien, Uber Security Breach May Have Affected Up to 50,000 Drivers, LA TIMES (Feb. 27, 2015), 
available at http://www .latimes.com/business/technology/la-fi-tn-uber-data-breach-20150227-story.html. 
76 Timberg, Rider Database, supra note 21. 
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privacy. Following the revelation that Uber used God View to track riders, Schneier 
wrote: 


None of us wants to be stalked -- whether it's from looking at our location 
data, our medical data, our emails and texts, or anything else -- by friends 
or strangers who have access due to their jobs. Unfortunately, there are 
few rules protecting us... . 


As long as we have to give our data to companies and government 
agencies, we need assurances that our privacy will be protected. 
Moreover, we need legal limits on what can be done with our data . 
. . . Making these changes doesn't require an act of Congress. It's 
something that the Federal Trade Commission can do . . . As long 
as companies are collecting and storing our data, they need to be 
held to standards of security and professionalism. ”® 


63. Even after the audit following the God View fiasco, Bruce Schneier said there were 
“questions unanswered” about Uber’s surveillance power and stated he “saw 
nothing in their statements” to alleviate privacy concerns.” 


64. Privacy experts have also explained that Uber’s data collection practices are 
excessive. Marc Rotenberg, the President of EPIC, and Julia Horwitz, Consumer 
Privacy Director at EPIC, previously warned: 


The app model is also a data vacuum, gathering detailed 
information about users and drivers that that the company controls. 
Much of the data collection is excessive. For example, [...] the 
Uber privacy policy also reveals that the company collects the IP 
addresses, manufacturers, and operating systems of users’ phones. 
Uber collects information about the mobile web browsers used by 
its customers, exchanges data with advertisers, and tracks users 
across the Internet.*” 


65. Rotenberg and Horwitz have also described model privacy laws for Uber and other 
ridesharing services: 


What would the law do? First, Uber would be limited in the type of 
personal information it can collect. Payment information is obvious, as is 
travel information. But beyond those categories, the burden would be on 
Uber to justify the collection of personal data. Second, Uber would be 





78 Bruce Schneier, Why Uber’s ‘God View’ is Creepy, CNN (Dec. 4, 2014) 
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required to delete passenger information after it was no longer needed. It 
seems obvious that once the ride is completed, Uber should delete the 
travel records. Third, users should be able to access at any time a complete 
record of all of the information Uber has about them: all of the records and 
logs and advertising promotions. If Uber has information about 
passengers, they should know what Uber knows.*! 


66. “It’s a huge trove of data that could be used for a whole number of uses,” said 
Christopher Parsons, a digital privacy expert at Citizen Lab, a research center at the 
University of Toronto.*” 


67. Other cyber security experts, such as Lorrie Faith Cranor, director of the CyLab 
Usable Privacy and Security Laboratory at Carnegie Mellon University, have noted 
that, “This is written in a way to protect themselves from liability” and “[t]his is a 
company that collects and uses a lot of data.”® 


H. Members of Congress and Others Have Expressed Concern About Uber’s 
Business Practices 


68. Senator Al Franken has confronted Uber directly about the company’s data 
collection practices. After Uber’s use of God View was exposed, Senator Franken 
asked Uber to account for the “scope, transparency, and enforceability” of Uber’s 
data collection practices. ** He was especially troubled because “there appears to be 
evidence of inconsistent practices with the polic[ies].” 


69. Following Uber’s cursory reply*°, Senator Franken wrote again to the company, 
demanding that it provide a more detailed reply, including how many Uber 
employees have access to Uber’s God View program and why Uber’s employees 
need access to God View at all.*° 


70. Senator Claire McCaskill and Senator Bill Nelson wrote to Uber and demanded a 
response to their “concerns about [Uber’s] data practices and its commitment to the 
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terms of its own privacy policy,” especially in regards to tracking user location and 
accessing user data. 


71. Senator Cory Booker has also cautioned that “ride hailing services [...] shouldn't be 
exempt from regulations that ensure consumer safety and privacy.”** 


72. California State Assemblymember Ed Chau has introduced Assembly Bill 866, state 
legislation that would protect the privacy rights of Californians who use 
“transportation network companies” such as Uber. *? Assemblymember Chau 
explained: 


Limiting the data collected by ridesharing mobile applications does 
not reduce the functionality and availability to consumers that use 
and love them. On the contrary, this legislation is not about 
limiting the consumer, it is about giving the consumer ownership 
of their privacy, which can be the subject of abuse under certain 
circumstances. It's time to put the consumer in the driver seat when 
it comes to who controls their personal information instead of 
having them take a backseat!” 


73. Jeremy Pollock, a legislative aide to San Francisco Supervisor John Avalos, 
commented, “They have this bullying attitude like they can do whatever they want 
and they have a vindictive attitude toward people who get in their way.””! 


H. Uber Regularly Abuses Its Access to User Telephone Numbers 


74. Uber also regularly sends out unsolicited text messages to customers and to 
customers’ contact lists. 


75. Regarding the disclosure of user information to third parties, Uber's currently states 
that user information will only be disclosed in two circumstances. First, participants 
may use a referral service, which the policy states will prompt a one-time email to 
participants' contacts, inviting them to join Uber. Second, where the “split a trip 
fare” option is chosen, a text message will be sent to the party with whom the user 
wishes to split the fare, who may accept or decline the request to split. Uber states 
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that it will not use this information for any marketing purpose unless prior consent is 
obtained or unless otherwise explicitly stated.” 


76. However, in December 2014, Jason Koebler of Motherboard, a technology and 
science online news source, reported that the FTC had received several complaints 
from “[p]eople who have never driven for or even used the service” who “said they 
are still receiving a high volume of text messages from Uber and have been unable 
to make them stop.”” 


77. Koebler also noted, “The text messages we’ve seen from Uber don’t explain that 
texting ‘STOP’ will actually stop them—and some of the complaints specifically 
mention that the keyword didn’t work.” 


78. Those who receive such messages express outrage at their frequency; the difficulty 
of unsubscribing; and the fact that the users never consented to giving their details 
or the details of third parties connected to them. 


79. For example, user DanielMiami said: 


This is disturbing, my girl just text me saying she received a text message 
from uber [sic] saying I invited her to become a driver. 


"UberMSG: Congratulations! Your friend Daniel wants you to be an Uber 
partner. Both of you can make money when you APPLY HERE: 


t.uber.com/cashec" 


1. How did they get her phone number? 
2. That's not even my referral promo code 


Do they have access to our contact list in our phones?” 


80. User UberHammer said, “I made a drinking game out of the texts. Downed a beer 
after each text received. Had to drink 8 last Friday night.””° 


81. User Wei Rodrigues wrote “Every Uber spam text I get comes from a completely 
different number. I tried blocking one when I Ist got irritated. They kept coming. It 
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was then I realized they were different source #s. They make sure you're gonna keep 
getting them!””’ 


I. Uber’s Text Messaging Activity May Violate the Telephone Consumer 
Protection Act 


82. In view of the above, Uber's text messaging activity may violate the Telephone 
Consumer Protection Act, 47 U.S.C. § 227 et seq. (““TCPA”’). 


83. Under the federal regulations applying the Act, Uber is prohibited from: 


“[I]nitiat[ing], or caus[ing] to be initiated, any telephone call that includes 
or introduces an advertisement or constitutes telemarketing, using an 
automatic telephone dialing system or an artificial or prerecorded voice, to 
any of the lines or telephone numbers described in paragraphs (a)(1)(i) 
through (iii) of this section, other than a call made with the prior express 
written consent of the called party . . .* 


84. “Telephone call” has been interpreted to include text messages for the purposes of 
the TCPA.” 


85. According to the FCC, “[t]he term advertisement means any material advertising the 
commercial availability or quality of any property, goods, or services”'”? while 
“automatic telephone dialing system and autodialer mean equipment which has the 
capacity to store or produce telephone numbers to be called using a random or 
sequential number generator and to dial such numbers.”!”! 


86. There is currently a class action suit before the United States District Court for the 
Northern District of California which alleges that Uber’s text message spam 
violated the TCPA because the messages constituted telemarketing or advertising 
and were sent to them without prior express written consent.” At least one plaintiff 
has received texts despite never having been an Uber member driver or user. 
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IV. Legal Analysis 





A. The FTC’s Section 5 Authority 


87. The FTC Act prohibits unfair and deceptive acts and practices, and empowers the 
Commission to enforce the Act’s prohibitions.'”* These powers are described in 
FTC Policy Statements on Deception!” and Unfairness.'”° 


88. A trade practice is unfair if it “causes or is likely to cause substantial injury to 
consumers which is not reasonably avoidable by consumers themselves and not 
outweighed by countervailing benefits to consumers or to competition.” 0 

89. The injury must be “substantial.” 

may also include “unwarranted health and safety risks. 

other “more subjective types of harm” generally do not make a practice unfair. 

Secondly, the injury “must not be outweighed by an offsetting consumer or 

competitive benefit that the sales practice also produces.”''' Thus the FTC will not 

find a practice unfair “unless it is injurious in its net effects.”'!* Finally, “the injury 
must be one which consumers could not reasonably have avoided.”''* This factor is 
an effort to ensure that consumer decision making still governs the market by 
limiting the FTC to act in situations where seller behavior “unreasonably creates or 
takes advantage of an obstacle to the free exercise of consumer decision making.”''* 

Sellers may not withhold from consumers important price or performance 

information, engage in coercion, or unduly influence highly susceptible classes of 

consumers." 


Typically, this involves monetary harm, but 


109 
” =? Emotional harm and 
110 
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90. An act or practice is deceptive if it involves a representation, omission, or practice 
that is likely to mislead the consumer acting reasonably under the circumstances, to 
the consumer’s detriment.”''® 


91. There are three elements to a deception claim. First, there must be a representation, 
omission, or practice that is likely to mislead the consumer.''’ The relevant inquiry 
for this factor is not whether the act or practice actually misled the consumer, but 
rather whether it is likely to mislead.'"* 


92. Second, the act or practice must be considered from the perspective of a reasonable 
consumer.''’ “The test is whether the consumer’s interpretation or reaction is 
reasonable.” '”° The FTC will look at the totality of the act or practice and ask 
questions such as “how clear is the representation? How conspicuous is any 
qualifying information? How important is the omitted information? Do other 
sources for the omitted information exist? How familiar is the public with the 
product or service?”!?! 


93. Finally, the representation, omission, or practice must be material.” Essentially, the 
information must be important to consumers. The relevant question is whether 
consumers would have chosen another product if the deception had not occurred.'”° 
Express claims will be presumed material." Materiality is presumed for claims and 
omissions involving “health, safety, or other areas with which the reasonable 
consumer would be concerned.”!”° 


94. The FTC presumes that an omission is material where “the seller knew, or should 
have known, that an ordinary consumer would need omitted information to evaluate 
the product or service, or that the claim was false . . . because the manufacturer 
intended the information or omission to have an effect.”'”° 


95. The Commission has previously found that a company may not alter the privacy 
settings of its users.” 
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96. The Commission has previously found that a company may not repurpose user data 
for a use other than the one for which the user’s data was collected without first 
obtaining the user’s “express affirmative consent.”!** 


B. Count I: Deceptive Representation that “Users Will be in Control” of their 
Privacy Settings”? 


97. As described in detail above, Uber represented to consumers that “users will be in 
control” of their privacy settings and can “choose whether to share the data with 
Uber.” 


98. As described in detail above, users are not truly in control of the data they disclose 
to Uber. Uber retains the ability to track users even if users choose not to share 
location data with Uber. Android users cannot turn off contact sharing once they 
have used the app, and all users cannot turn off approximate location sharing after 
downloading the app. 


99. Users could not reasonably know that they are not truly in control of what data they 
want to share with Uber. 


100. Uber’s representations are likely to mislead the reasonable consumer. 


101. There is a clear divide between Uber's representations as to their consumers' control 
over their personal information, and Uber’s actual business practices. Consumers 
are led to believe that they retain control over their personal data, when in fact they 
do not. 


102. Therefore, Uber engaged in a deceptive act or practice in violation of Section 5(a) of 
the FTC Act, 15 U.S.C. § 45(a). 


C. Count II: Deceptive Representation that Users Would be Able to Opt Out of 
Targeted Advertising 


103. As described above, Uber represented to consumers in 2013 that they would have 
the opportunity to opt out of targeted advertising. 


104. Uber also represented to consumers in 2015 that they would be “in control” of their 
data under the new privacy policy.'*! 
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105. Uber chose not to provide a means of opting out of targeted advertising in its 
revised privacy policy. 


106. Given Uber’s privacy assurances, Uber users acting reasonably would likely be 
misled into believing that they can opt out of targeted advertising under the revised 
policy, when in fact they cannot. 


107. This inconsistency is to Uber users’ detriment; their personal information could be 
disclosed to parties they did not intend to disclose to. 


108. Therefore, Uber’s choice not to provide a means of opting out of targeted 
advertising in its revised privacy policy constitutes a deceptive act or practice in 
violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). 


D. Count III: Deceptive Representation that Users’ Data Would be Protected by 
Robust Security Measures 


109. As described in detail above, Uber users would reasonably expect Uber to abide by 
its policy statement and “take appropriate measures to protect [their] personal 
information.” 


110. Industry experts have identified that Uber’s data collection of intimate customer 
details is valuable to unauthorized third party users and is likely vulnerable to 
attacks. 


111. Uber’s database has already been successfully hacked before, exposing tens of 
thousands of its drivers’ information. 


112. Uber has a history of allowing individuals within and without the company to have 
unrestricted access to its customers’ personal information. 


113. Therefore, Uber’s failure to adequately disclose that its security measures may not 
protect its customer’s personal constitutes a deceptive act or practice in violation of 
Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). 


114. Users could not reasonably be aware of the inadequate disclosures regarding the 
potential for security breach of the privacy policy. 


115. The inadequate disclosures are not outweighed by countervailing benefits to 
consumers or to competition. 


116. Uber’s inadequate disclosures constitute deceptive acts or practices in violation of 
Section 5 of the FTC Act, 15 U.S.C. § 45(a). 
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E. Count IV: Deceptive and Unfair Practice of Tracking Users’ IP Addresses 


117. Uber’s IP address tracking practice constitutes an unfair business practice because it 
is likely to cause substantial injury to consumers, which is not reasonably avoidable 
by consumers themselves and not outweighed by countervailing benefits to 
consumers or to competition. The injury is substantial because deriving users’ 
proximate locations without their knowledge poses potential safety risks. Uber’s IP 
tracking practice also undermines consumers’ decision-making autonomy when 
consumers expressly decline to disclose location data to Uber. 


118. This injury is not reasonably avoidable by consumers themselves. Consumers must 
completely delete the app or quit using Uber’s services to stop Uber from collecting 
their IP addresses. Consumers are thus forced to choose between forgoing their 
privacy interest and forgoing Uber’s services, and there is no way consumers can 
use Uber while preventing their location information from being collected. 


119. There is no evidence that Uber’s IP address data collection practice provides 
overweighing benefits to consumers or to competition. 


120. Uber’s IP address tracking practice also constitutes deceptive practice. As 
referenced above, Uber claims that users will be able to choose whether to permit 
Uber to collect location data. This statement is likely to mislead consumers into 
believing that they can choose to not disclose location information to Uber after 
downloading the app. 


121. Reasonable consumers are likely to misinterpret Uber’s representation about user 
control. Reasonable consumers would not expect that Uber might use their IP 
addresses for tracking purposes that violate Uber’s own pledge. 


122. The misrepresentation is material because whether users are able to choose to 
disclose their location information is important and would have influenced the 


consumer decision-making processes. 


V. Prayer for Investigation and Relief 





123. EPIC urges the Commission to investigate Uber Technologies, Inc., and enjoin its 
unfair and deceptive data collection practices with respect to Uber’s revised privacy 
policy that the company plans to implement on July 15, 2015. 


124. Specifically, EPIC requests the Commission to: 


a. Initiate an investigation of Uber’s business practices, including the 
collection personal data from users of location data and contact list 
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information ; 


b. Halt Uber’s collection of user location data when it is unnecessary for the 
provision of the service; 


c. Halt Uber’s collection of user contact list information; 


d. Require the implementation of data minimization measures, including the 
routine deletion of location data once the ride is completed; 


e. Mandate algorithmic transparency, including the publication of specific 
information about the rating techniques established by Uber to profile and 
evaluate customers; 


f. Require Uber to comply with the Consumer Privacy Bill of Rights; 


g. Investigate Uber’s possible violation of the Telephone Consumer 
Protection Act; 


h. Investigate other companies engaged in similar practices; and, 


i. Provide such other relief as the Commission finds necessary and 
appropriate. 


Respectfully Submitted, 


/s/ 
Marc Rotenberg, EPIC Executive Director 
Julia Horwitz, Director, EPIC Consumer Privacy Project 


John Davisson, EPIC IPIOP Clerk 

Eogan Hickey, EPIC IPIOP Clerk 

Britney Littles, EPIC IPIOP Clerk 

Ximeng (Sammy) Tang, EPIC IPIOP Clerk 
Michele Trichler, EPIC IPIOP Clerk 
Kasey Wang, EPIC IPIOP Clerk 

Jennifer Weekley, EPIC IPIOP Clerk 
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